Extracted

• • Target

    Formbook.exe

  • Size

    177KB

  • MD5

    325e9bc40c665d845e9edd875631ec48

  • SHA1

    6f325ce61e9d8916cced15919cbd84fce584e14f

  • SHA256

    c3b9bd6a3c03e763f6255c275cbb3a068de6feef7417d18b7a3e92c6b28753e5

  • SHA512

    02760fc7cd93075f8fdb35e0a87dfee062c718fe03a28408da6a03d37eb6e39a3388c0c01611cee8d28422b930346c92f4242538a29daa8ad0a3b5cdf8d69dc4

  • SSDEEP

    3072:FamFfATiz/CDWALN/Prl8QCUaIUZt/nmYVo+jVMDlMUqc:TJpCnN/58HUaIUZAA/jVMDXq

  Score

  10^/10

  formbookxloadert65qdiscoveryloaderratspywarestealertrojan

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader

  • Xloader payload

    rat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2